htmx.config.withCredentials defaults to false, allow cross-site Access-Control requests using credentials such as cookies, authorization headers or TLS client certificates
We don’t support OPTIONS in the webhook node as an option, I would expect your cors headers to only kick in if you were making a GET or PUT request, have you tried making a call with something like curl directly to see what is being sent?
If you do need the OPTIONS method then I would either create a feature requests for that or handle it outside of n8n like in your reverse proxy.